T09 · Insecure Skill Coding Practices
Error
- Location
scripts/shared/storage/keys.js:50- Finding
Private keys are stored in plaintext when no master key is configured
- Content
View full analysis
- Remediation
View remediation
Security audit
Vai Layman88
Security checks for vulnerabilities and agentic risk
Overview
This skill appears purpose-built for decentralized identity, but it handles private keys and authentication proofs in ways that deserve review before installation.
Install only if you are comfortable with this skill managing agent identity keys on the local machine. Set a strong `BILLIONS_NETWORK_MASTER_KMS_KEY` before creating or importing identities, protect `$HOME/.openclaw/billions` as sensitive secret storage, avoid passing real private keys or tokens on the command line, and verify every signing/linking request before allowing the agent to run it.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/shared/storage/base.js:25- Finding
Sensitive identity files are written without explicitly restrictive permissions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/verifySignature.js:18- Finding
Verification challenges do not expire and are not consumed after successful use
- Content
View full analysis
entry.did === did); if (index >= 0) { // Update existing entry entries[index] = { did, challenge, created_at }; } else { // Add new entry entries.push({ did, challenge, created_at }); } await this.writeFile(entries); } ``` Verification retrieves the challenge, compares it, and returns success without deleting or rotating it: ```js // Get the stored challenge const challenge = await challengeStorage.getChallenge(args.did); if (!challenge) { console.error(`Error: No challenge found for DID: ${args.did}`); console.error("Generate a challenge first with generateChallenge.js"); process.exit(1); } // Create JWS packer and unpack token const jws = new JWSPacker(kms, resolveDIDDocument); const basicMessage = await jws.unpack(byteEncoder.encode(args.token)); // Verify the sender if (basicMessage.from !== args.did) { console.error( `Error: Invalid from: expected from ${args.did}, got ${basicMessage.from}`, ); process.exit(1); } // Verify the challenge matches const payload = basicMessage.body; if (payload.message !== challenge) { console.error( `Error: Invalid signature: c ...[truncated 2300 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (52)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description emphasizes decentralized identity workflows, but the documentation also reveals local private-key custody, optional plaintext key storage, and raw key management behavior. This mismatch is dangerous because users and orchestrators may approve or auto-invoke the skill as an identity helper without realizing it also handles highly sensitive key material and credential stores.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation states that private keys may be stored in plaintext when the master KMS key is not configured, but this warning appears deep in the security section rather than prominently before identity creation. That creates a realistic risk that operators will generate identities and persist secrets insecurely on disk without understanding the exposure.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The skill explicitly accesses credential and identity storage files, including verifiable credentials and key material, which are highly sensitive assets in an agent environment. Even if intended for legitimate identity workflows, exposing a skill with broad access to these stores raises the risk of credential disclosure, misuse, or unintended exfiltration through subsequent tool actions.
- Content
md - `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext) - `defaultDid.json` - DID identifiers and public keys - `challenges.json` - Authentication challenges history - `credentials.json` - Verifiable credentials - `identities.json` - Identity metadata - `profiles.json` - Profile data
Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
ws 8.18.0 is flagged for memory disclosure and memory-exhaustion denial-of-service issues in WebSocket handling. In an agent skill that may communicate with remote services, any reachable WebSocket surface increases risk because malformed or fragmented frames from a remote peer could crash the process or expose memory contents.
- Content
Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more
High
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
brace-expansion 2.0.2 has multiple denial-of-service issues caused by pathological expansion patterns that can cause extreme CPU or memory consumption. Even though this is often a build/tooling dependency, it is still a real vulnerability if any runtime path or auxiliary tooling processes attacker-controlled glob-like strings.
- Content
Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more
High
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
fast-uri 3.1.0 is reported vulnerable to multiple URL parsing and canonicalization issues, including host confusion and SSRF-relevant edge cases. This is particularly relevant for an identity-oriented skill that may fetch remote schemas, DID documents, or attestations, because parser inconsistencies can let attackers bypass allowlists or redirect requests to unintended internal targets.
- Content
Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
ws 7.5.10 is flagged for a memory exhaustion DoS via fragmented frames and tiny chunks. If the affected WebSocket server/client code is reachable through RPC or network-facing components, a remote attacker may be able to degrade availability or crash the process with crafted traffic.
- Content
Known Vulnerable Dependency: underscore==1.13.6 — 1 advisory(ies): CVE-2026-27601 (Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS)
High
- Category
- Supply Chain
- Confidence
- 87% confidence
- Finding
underscore 1.13.6 is flagged for uncontrolled recursion in functions such as flatten and isEqual, which can cause denial of service on maliciously nested inputs. If any dependency applies these helpers to untrusted request or response data, a remote attacker may trigger excessive recursion and process instability.
- Content
Known Vulnerable Dependency: undici==5.29.0 — 12 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +9 more
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
undici 5.29.0 is associated with multiple HTTP parsing, smuggling, and request/response confusion issues. This is especially concerning in a decentralized identity skill that likely performs outbound HTTP fetches for DID documents, registries, schemas, or attestations, because parser discrepancies can enable SSRF, cache poisoning, or cross-request contamination.
- Content
Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
ws 8.17.1 is flagged for both uninitialized memory disclosure and memory exhaustion DoS. Because this project includes multiple network and RPC-related packages, any reachable WebSocket handling exposed to untrusted peers materially increases the chance of remote availability impact or data leakage.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 75% confidence
- Finding
The code persists credential material to a predictable local file (credentials.json), which can expose sensitive identity artifacts if the host is multi-user, compromised, or the file permissions are weak. In an agent identity skill, stored credentials may enable impersonation, privacy loss, or unauthorized proof generation, making local credential persistence more sensitive than ordinary application state.
- Content
js function newDataStorage(ethStateStorage) { return { credential: new CredentialStorage( new IdentitiesFileStorage("credentials.json"), ), identity: new IdentityStorage( new IdentitiesFileStorage("identities.json"),
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
When no master key is available, the code intentionally falls back to storing raw private key material on disk in plaintext. In a skill that manages decentralized identity and authentication keys, this creates a direct secret-at-rest exposure: any local user, malware, backup system, or accidental file disclosure can recover the agent's private keys and impersonate identities or forge authentication proofs.
- Content
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } } homepage: https://billions.network/
When to use this Skill
Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.
- When you need to link your agent identity to an owner.
- When you need to sign a challenge.
- When you need to link a human to the agent's DID.
- When you need to verify a signature to confirm identity ownership.
- When you use shared JWT tokens for authentication.
- When you need to create and manage decentralized identities.
After installing the plugin run the following commands to create an identity and link it to your human DID:
bash cd scripts && npm inst
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } } homepage: https://billions.network/
When to use this Skill
Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.
- When you need to link your agent identity to an owner.
- When you need to sign a challenge.
- When you need to link a human to the agent's DID.
- When you need to verify a signature to confirm identity ownership.
- When you use shared JWT tokens for authentication.
- When you need to create and manage decentralized identities.
After installing the plugin run the following commands to create an identity and link it to your human DID:
bash cd scripts && npm inst
Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The lockfile pins ws 8.18.0 under @ethersproject/providers, and the reported advisories include uninitialized memory disclosure and memory-exhaustion DoS in WebSocket handling. In an identity/agent-authentication skill that may maintain network connections to blockchain or verifier infrastructure, vulnerable WebSocket code increases exposure to remote attacks that can crash the process or leak process memory.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md function newDataStorage(ethStateStorage) { return { credential: new CredentialStorage( new IdentitiesFileStorage("credentials.json"), ), identity: new IdentityStorage( new IdentitiesFileStorage("identities.json"),
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md function newDataStorage(ethStateStorage) { return { credential: new CredentialStorage( new IdentitiesFileStorage("credentials.json"), ), identity: new IdentityStorage( new IdentitiesFileStorage("identities.json"),
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md function newDataStorage(ethStateStorage) { return { credential: new CredentialStorage( new IdentitiesFileStorage("credentials.json"), ), identity: new IdentityStorage( new IdentitiesFileStorage("identities.json"),
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js function newDataStorage(ethStateStorage) { return { credential: new CredentialStorage( new IdentitiesFileStorage("credentials.json"), ), identity: new IdentityStorage( new IdentitiesFileStorage("identities.json"),
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This code explicitly falls back to storing private keys with provider: "plain" when no master key is available, which means sensitive cryptographic material can be persisted to disk unencrypted. In an agent identity skill, those keys are high-value secrets: compromise of the local filesystem, backups, logs, or container volumes could allow an attacker to steal the keys and impersonate the agent or misuse attestations.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The README instructs users to run
npx clawhub@latest install verified-agent-identity, which fetches and executes the latest package version at install time. Using a moving target for an installation/bootstrap tool weakens supply-chain integrity because a compromised or malicious future release could be executed automatically by users or agents.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
This second installation example repeats the same unsafe pattern of invoking
npx clawhub@latest, which downloads and runs unpinned code. In an agent-skill context, users may copy-paste the command directly, increasing exposure to supply-chain compromise if the upstream package changes or is hijacked.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation explicitly tells users to pass an Ethereum private key on the command line via
--key <your-ethereum-private-key>. Secrets supplied as CLI arguments are commonly exposed via shell history, process listings, audit logs, terminal scrollback, and orchestration tooling, making this a direct credential-handling weakness for highly sensitive key material.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill requires Node, uses an optional environment secret, and explicitly performs network-backed identity and attestation operations, but it does not declare an explicit tool/permission scope. In an agent environment, missing scope declarations can cause the skill to be invoked with broader-than-expected access and make review and containment harder.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The invocation examples are broad enough to match common identity-related requests and instruct the agent to perform sensitive identity-linking actions with minimal exclusion conditions. In practice, that can lead to over-eager triggering of signing/linking flows in response to loosely phrased user prompts, increasing the chance of unauthorized proof generation or identity association.
- Content